ETS
Home
Created by Claudiu Tabac - © 2026
This material is open for educational and research use. Commercial use without explicit permission from the author is not allowed.
BP-041 Hidden Refresh Token Persistence
Long-lived identity hijacking through stolen refresh tokens—one of the stealthiest cloud persistence techniques threatening modern enterprises.
Understanding the Threat
This breach pattern exploits long-lived refresh tokens to maintain persistent, stealthy access to cloud and SaaS environments for extended periods—sometimes months. Unlike traditional session hijacking, refresh token persistence operates beneath detection thresholds, silently regenerating valid credentials.
Attackers acquire these tokens through infostealers, endpoint compromise, M365 extraction, OAuth theft, or browser cookie harvesting. Once obtained, they weaponize them for indefinite impersonation.
Why Refresh Tokens Are Dangerous
  • Bypass multi-factor authentication completely
  • Persist through password resets
  • Work seamlessly across devices
  • Operate for 30–90 days by default
  • Survive browser restarts and reboots
  • Rarely monitored by security teams
  • Enable silent, on-demand token generation
Attack Mechanics & Persistence
1
Initial Compromise
Attackers deploy infostealers, exploit endpoint vulnerabilities, or harvest tokens from browser storage to obtain valid refresh tokens.
2
Token Extraction
Refresh tokens extracted from M365 sessions, OAuth flows, federated authentications, or developer workstations with cloud CLI tools.
3
Silent Regeneration
Stolen refresh tokens generate fresh access tokens indefinitely, bypassing MFA, password changes, and device trust policies.
4
Deep Persistence
Attackers maintain low-noise access for weeks or months, conducting reconnaissance, data exfiltration, and privilege escalation undetected.
Attacker Objectives
Silent Impersonation
Assume victim identities indefinitely without triggering authentication alerts or generating suspicious login events.
Long-Term Access
Maintain durable presence across SaaS platforms, cloud environments, and internal systems for extended reconnaissance.
On-Demand Tokens
Generate fresh access tokens whenever needed, circumventing MFA and conditional access controls effortlessly.
Privilege Escalation
Leverage stolen tokens to access admin portals, escalate permissions, and move laterally through cloud infrastructure.
Data Harvesting
Silently read emails, internal communications, files, and sensitive documents over extended periods without detection.
Control Evasion
Bypass password resets, device trust policies, and session monitoring through persistent refresh token replay.
Critical Misconfigurations
These identity architecture weaknesses enable BP-041 exploitation and amplify attacker persistence capabilities.
1
MC-401: Excessive Token Lifetimes
Refresh tokens configured with 90+ day validity periods drastically extend attacker persistence windows and increase organizational risk exposure.
2
MC-402: No Token Revocation
Absence of automated token revocation procedures means compromised credentials remain active indefinitely, even after incident detection.
3
MC-403: Cross-Device Token Reuse
Allowing session persistence across unmanaged devices without restriction or monitoring enables widespread token exploitation.
4
MC-404: Weak Token Storage
Tokens stored unencrypted in browser caches or OS credential stores become easily accessible targets for infostealers and malware.
Detection & Response Signals
01
DL-092: Refresh Token Replay Detection
Identify identical tokens replayed from geographically dispersed or anomalous IP addresses within suspicious timeframes.
02
DL-041: Lateral API Token Issuance
Detect stolen refresh tokens rapidly generating multiple access tokens across different services and APIs.
03
DL-025: Impossible Travel Patterns
Flag access tokens created from distant geographic locations within physically impossible time windows.
04
DL-099: Session Extension Anomalies
Monitor privileged sessions silently extended far beyond typical user behavior or policy thresholds.

Detection Challenges
Refresh token abuse generates minimal authentication logs and often appears as legitimate user activity, making behavioral analytics and token lineage tracking essential for detection.
Attack Chain Integration
BP-041 spans multiple stages of the Identity Attack Chain, forming the foundation for long-term cloud compromise.
1
Stage 3
Credential Acquisition
Initial token theft via infostealers or endpoint compromise
2
Stage 6
Token Tampering
Session hijacking through refresh token replay
3
Stage 8
Identity Persistence
Establishing durable access through token regeneration
4
Stage 9
Action on Objectives
Data exfiltration, privilege escalation, lateral movement
Threat Actor Profiles
APT29 (ICTAM-001)
State-sponsored group demonstrating mastery of long-lived token manipulation and persistent cloud access techniques.
Lapsus$ (ICTAM-011)
Extortion group leveraging refresh token hijacking during high-impact breaches of enterprise cloud environments.
DarkWeb Markets (ICTAM-030)
Underground marketplaces trafficking stolen refresh tokens at scale, enabling widespread identity compromise.
RaaS Affiliates (ICTAM-020)
Ransomware operators using automated token replay for establishing persistent footholds before encryption.
Related Storylines
  • ETS-009: Privileged Session Hijack → Automated Exfiltration
  • ETS-003: Machine Token Theft → Cloud Escalation
About
Created by Claudiu Tabac — © 2026
This framework is open for educational and research use. Commercial use without explicit permission from the author is not allowed.